GoKawiilCisco patches actively exploited zero-day in Identity Services Engine (CVE-2026-76460)
Cisco has issued patches for a maximum-severity flaw in its Identity Services Engine and ISE-PIC products that allows attackers to bypass authentication on an API endpoint and gain unauthorized administrative access, regardless of configuration. Cisco's security team confirmed the vulnerability, tracked as CVE-2026-76460, is being actively exploited and there are no workarounds available, making immediate patching the only defense.
GoKawiil's interpretation of the reporting above, not reported fact.
ISE is widely used to enforce Zero Trust access control across enterprise networks, so an authentication bypass here could let attackers seize control of core identity and access infrastructure. Active exploitation before a fix was available raises the stakes for organizations that haven't yet patched, as attackers may already have footholds requiring forensic investigation and node re-imaging rather than a simple update.
- CVE-2026-76460 lets attackers bypass authentication on Cisco ISE and ISE-PIC via a vulnerable API endpoint.
- Cisco confirms active exploitation in the wild and says no workarounds exist besides patching.
- Affected admins should check access logs for suspicious usernames and consider re-imaging compromised nodes.
Source: bleepingcomputer.com, 2026-09-17
Published there as: “Cisco warns of max severity ISE zero-day exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.